# Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems

- Type: Case Law
- Source: CJEU
- Date: 2020-07-16
- Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=6120
- Canonical: https://overview.legal/posts/6120
- Topics: Controllers, Social Media, Processors, Processing Agreement, International Transfer, IP Address, Data Portability, Lawful Basis, Privacy Shield, Recipient

## Summary

“[…] the standard data protection clauses adopted by the Commission on the basis of Article 46(2)(c) of the GDPR are solely intended to provide contractual guarantees that apply uniformly in all third countries to controllers and processors established in the European Union and, consequently, independently of the level of protection guaranteed in each third country. In so far as those standard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contrac

## Sections (3)

### ¶133

It follows that the standard data protection clauses adopted by the Commission on the basis of Article 46(2)(c) of the GDPR are solely intended to provide contractual guarantees that apply uniformly in all third countries to controllers and processors established in the European Union and, consequently, independently of the level of protection guaranteed in each third country. In so far as those standard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contractual obligation to ensure compliance with the level of protection required under EU law, they may require, depending on the prevailing position in a particular third country, the adoption of supplementary measures by the controller in order to ensure compliance with that level of protection.

> Topics: Processing Agreement, International Transfer, Controllers · Applies: gdpr-art-46-par-2-pnt-c-en

### ¶134

In that regard, as the Advocate General stated in point 126 of his Opinion, the contractual mechanism provided for in Article 46(2)(c) of the GDPR is based on the responsibility of the controller or his or her subcontractor established in the European Union and, in the alternative, of the competent supervisory authority. It is therefore, above all, for that controller or processor to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data, whether the law of the third country of destination ensures adequate protection, under EU law, of personal data transferred pursuant to standard data protection clauses, by providing, where necessary, additional safeguards to those offered by those clauses. […]

> Topics: Recipient, Processors, Processing Agreement, Supervisory Authorities · Applies: gdpr-art-46-par-2-pnt-c-en

### ¶137

That validity depends, however, on whether, in accordance with the requirement of Article 46(1) and Article 46(2)(c) of the GDPR, interpreted in the light of Articles 7, 8 and 47 of the Charter, such a standard clauses decision incorporates effective mechanisms that make it possible, in practice, to ensure compliance with the level of protection required by EU law and that transfers of personal data pursuant to the clauses of such a decision are suspended or prohibited in the event of the breach of such clauses or it being impossible to honour them.

> Topics: Personal Data · Applies: gdpr-art-46-par-1-en, gdpr-art-46-par-2-pnt-c-en

## Cited law provisions (2)

### GDPR — gdpr-art-46-par-1-en

In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

### GDPR — gdpr-art-46-par-2-pnt-c-en

standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

---
Generated by overview.legal · https://overview.legal/posts/6120 · 2026-08-22